IceWarp Server GUI Reference

Transcription

1 IceWarp Unified Communications IceWarp Server GUI Reference Version 11.3 Published on 12/22/2015

2

3 Contents Reference Manual... 5 Administrative Console... 6 Main Menu... 7 Remote Server Administration Remote Console as an Installer Bookmarks Bookmarks Manager Configuration Backup and Restore Toolbar How to Import Users from Windows or AD Servers How to Import Users from LDAP / Active Directory Import/Export Users from/to File Licenses WebAdmin WebAdmin Customization Tooltips API Console Miscellaneous Find Dialog Status Bar Languages Node Tree Search Copy Button Live Assistant Account Colors Shared Topics DNS Records Configuration A Records SRV Records Simple RegEx Tutorial ^' and '$' '*', '+', and '?' Braces { } ' ' OR operator ('.') Bracket expressions Command Line Tool... 39

4 php.user.ini Advantages snmp-mib.txt File Access Mode Policies Bypassing Rules/Filters Database Settings Step by Step Supported Databases Database Charset Path Variables for MySQL and FireBird Database Security Basics IceWarp Server Databases Server Variables Server Functions Server Commands Server Upgrade Best Practices Planning Upgrade Prior Upgrade Upgrade After Upgrade Upgrade to Version SQLite Database Domain Admin Rights domain.dat File Location Other Settings Schedule Select Accounts Server Security Weak Ciphers, PSI Compliance... 67

5 Reference Manual This reference manual covers topics that are common for all modules of IceWarp Server (e.g. Main Menu) as well as those that are shared between more IceWarp Server's modules. E.g. Database Settings, Access Mode, etc. Legend Icon Description Warning very important! Note or tip good to know. Note within a table. Figure link click the link to reveal the figure. Click it again to close it. (Works only in the CHM format.) Registered Trademarks iphone, ipad, Mac, OS X are trademarks of Apple Inc., registered in the U.S. and other countries. Microsoft, Windows, Outlook and Windows Phone are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Android is a trademark of Google Inc. IceWarp is a registered trademark in the USA and other countries. Page 5

6 Administrative Console Administrative console is the place where you can administer all IceWarp Server's functionalities. (Except for those managed via APIs.) The main console features are described in the following chapters. Page 6

7 Main Menu The main menu contains several sections which let you control some of the basic functions of the administration interface. Field Open Save settings Reload settings File Manager SQL Manager DNS Tool API console Backup settings Restore settings Exit Description Allows you to open any text file with the IceWarp Server text editor. Useful for viewing or editing plain text files. Saves any changes that have been made in the administration console. Reloads the administration console. Any changes that have been made (e.g. via the API or Web administration console) will be reflected after the reload. Shortcut F5 can be used. Opens File Manager to work with files. NOTE: Besides of usual shortcuts etc. you can use a command for changing directories. E.g. CD D:\ Opens SQL Manager. For more information, refer to the System Tools SQL Manager chapter. Opens DNS Tool. For more information, refer to the System Tools DND Tool chapter. Opens the API console window. Here you can manage API values. For more information, refer to the API Console (on page 30) chapter. Allows you to backup your current configuration to a.zip file. This file contains all your system settings, domains and users. This will also backup the spam and groupware databases if using the default SQLite databases meaning all contacts, calendars, and white & blacklists are backed up. NOTE: If your accounts are set to use a database instead of a file system, this database is NOT backed up, requiring you to backup the database manually and/or using the option in the System Tools System Backup Database section to synchronize your databases to another database server. Allows you to restore your system settings, databases, and users/domains from the backed up.zip file. Before restoring we recommend renaming the /IceWarp/Config folder in the event the restore fails and you need to fall back to default settings. This is possible if applying a backup from a much older version or from a different server where the paths were different. For more information, refer to the Configuration Backup and Restore chapter. Exit the IceWarp Server administration console. Page 7

8 Field Add Set as primary domain Cut, Copy, Paste Find Import Accounts From File/Export Accounts To File Import users from Windows Display mailbox Display statistics Display volume Description Allows you to add domains, accounts and public folders to IceWarp Server. The menu expands to let you select the appropriate type. Makes the domain you currently have selected primary. Primary domains are used to specify the system postmaster, which receives s destined to aliases such as admin, postmaster, abuse and others on the respective domain. The primary domain is always shown first in the list of domains. The admin account of the primary domain receives important messages such as those related to licensing (modules that are about to expire, activation issues, etc). Usual functions with usual use. Allows you to search all domains. You can search for user names, aliases or addresses. IceWarp Server uses basic search criteria with limited output. See more details in the Miscellaneous Find Dialog section. Please see Import/Export Users from/to File. Please see How to Import Users from Windows. Opens the Message Queue window showing the mailbox for the selected user account. Opens the User Statistics window for the selected user account. Opens the Volume window for the selected user account or domain. For information about the Bookmarks menu item, refer to the Remote Server Administration Bookmarks Bookmarks Manager chapter. Page 8

9 Field Use safe delete confirmation Show splash screen at startup Add to systray on minimize Automatically refresh current view Resolve addresses in current view Do not check for new version Description A confirmation dialog will appear before any deletion is performed. If checked, the welcome splash screen will be displayed when IceWarp Server console starts. If checked and you minimize IceWarp Server console, an icon is shown in your System Tray (the panel to the right of your Windows Taskbar). If not checked then IceWarp Server will be shown in the Taskbar instead. Causes data in current view to refresh every 30 seconds. Traffic Charts, Sessions, Statistics and ActiveSync devices are refreshed. If checked, IceWarp Server matches (checks) shown IP addresses with domain names using a DNS server. By default, IceWarp Server checks for a new version each time it starts. Select this option to stop IceWarp Server making this check. The Help menu contains common items such as links to the IceWarp website, Release notes and Quick Start Guide. The most important is the Help... menu item, which opens context sensitive help, and the License... item, which opens the License dialog where you can manage the product's license. The Purchase... item will bring you to IceWarp Purchase Processing where you can obtain a license if you are evaluating the product. The Check for new version option will query the official site to see if there is a newer version of IceWarp Server available. Page 9

10 The Export license... option serves the purpose of exporting your current license into an XML formatted file, which can be required when upgrading, or it can be saved for license backup. Clicking the Request support... item will open the browser on IceWarp Support Center web page, where you can submit technical and sales support inquiries. You need to have a login to the system in order to use it, but the registration is free, as part of your IceWarp Server license. Remote Server Administration The Remote Administration Console offers another option for customers to administer their IceWarp Server. The same administration console seen after installation is used for remote console so working from the remote console is extremely easy for administrators. NOTE: You must use the same version of the remote console as the IceWarp Server version you are connecting to, for example, if running server version then use the remote console version The connection to the server can be encrypted using SSL and is compressed for better performance. Connection settings can be saved and assigned a keyboard shortcut to connect to the machine in matter of seconds. You can run multiple instances of config.exe allowing you to compare settings on different servers. The context sensitive Help is accessible as usual by hitting the F1 key. You can download and run the remote console from any PC or server. Simply unzip it to any directory and you can access a remote IceWarp Server by launching the config.exe program. Upon start, the usual Administration Console is shown. To access a remote server, choose Bookmarks from the main menu or click the Connect button within the toolbar (computer icon to the left) to invoke the Bookmark Manager. Information about a remote connection is shown within the remote console title bar. The information syntax is as follows: description (target_server:ip) target_version_string where description corresponds with the Description field of the Remote Server dialog Connection tab (bookmark definition). Remote Console as an Installer Starting with , the Remote Administration Console is distributed as executable installer remoteconfig.exe (<install_dir>\install\) together with IceWarp Server. The installer is very simple: Allows only to choose install path (default is ProgramFiles\ IceWarp Remote Console \<version>). Automatically creates a desktop icon in the form of IceWarp Remote Console <version>. Automatically creates a Start menu icon in the form of IceWarp Remote Console/<version>. Allows to have multiple versions installed. Config.exe within the remote console is now build separately and implements one special feature that is not included in the server console. When you connect to the server with an incompatible console, it allows you to open a web browser and download the console directly from the server you are connecting to. (Of course, or later must be installed on the remote server). Page 10

11 Bookmarks Bookmarks Manager You can use the Bookmarks main menu item to connect to remote servers. The Bookmarks Manager allows you to pre-define any connections you require so you can quickly connect to a pre-configured server. Field Connect Quick Connect Add Edit Delete Close Description Select a server and click the button to connect to this server. Click the button to open the last used connection. Click the button to add a new connection. The Remote Server dialog opens. Click the button to perform changes in the selected connection. The Remote Server dialog opens. Select a server and click the button to remove this connection from the list. Click the button to close the dialog. Page 11

12 Field Description Server Administrator Password Quick ID Use SSL Connection Save password Connect OK Description Enter some descriptive text. The hostname or IP address with the appropriate port for the server you wish to connect to. NOTE: The connection is made over the Web Control port and by default this is port 80 in all version 10.x.x servers and prior to these versions the default port was If you are using any other port than 80 please ensure you specify the <server:port>, e. g.: demo.icewarp.com:32000 An administrator account for the remote server. The password for the administrator account. Optionally specify a QuickID for this connection, just digits are allowed. Connection Manager allows to sort connections according to this field. QuickID also works as a keyboard shortcut pressing Ctrl+Shift+QuickID will bring up the Connect dialog for this server. NOTE: If you click the Connect icon (within the toolbar), the connection with the lowest Quick ID defined is opened. If checked, all data transfer will be SSL encoded. If checked, your password will be saved so you do not have to enter it each time you connect. USE WITH CARE not recommended on public machines! Click the button to connect to the selected remote server. Click the button to save performed changes. Page 12

13 Field Use proxy server Host Port Username Description Check this if you need to access your server via a proxy server. The hostname or IP address of the proxy server. The port which you need to use to contact the proxy server (depends on your proxy server setup). Fill in credentials to the proxy server if required. Password Page 13

14 Configuration Backup and Restore The IceWarp Server configuration data is stored in these folders: <InstallDirectory>/config/ <InstallDirectory>/spam/ <InstallDirectory>/calendar/ <InstallDirectory>/_webmail/config/ These folders contain the following information: All system settings Users, domains, and all settings associated with each The Calendar and Spam folders contain the default SQLite databases for groupware and anti-spam. These hold the data for Contacts, Calendars, and White and Blacklists.) You can easily backup your configuration by using the File Backup settings menu option. You can also automate the backup by using the Tools System Backup feature. NOTE: If using external databases (MySQL, MSSQL, etc.) for accounts, groupware or anti-spam, you will need to backup the database manually or by using the option in the System Tools System Backup Database section to synchronize your databases to another database server. It is recommended to perform a backup after your final configuration. In the case of a hardware failure, you will be able to restore your configuration. It is also recommended to backup regularly and the backup file is kept somewhere safe such as written to a removable media and taken off site. Configuration Restore Choosing the Restore option will prompt you for a file containing backed up data. Once a file is chosen and opened, the configuration will be restored. Use this option carefully in order to prevent overwriting your active configuration with an older version. You should previously rename the /config directory so the restore is completely fresh. Should a server have to be rebuilt and all software freshly installed, this restore provides an excellent way of retrieving all the users' account information without retyping. NOTES: If you restore a backup to a different machine, then your Server Reference ID will change and your license Page 14

15 will be invalid. See the Licenses (on page 20) section for information on how to retrieve a new license. Also you should be aware that the restore will restore data to the same paths they were backed up from, so if you have: Modified your IceWarp Server configuration paths (see System Storage Directories) Changed the installation path for IceWarp Server Installed IceWarp Server on a new server with a different hard drive configuration If seeing problems with or the restore fails, you can view the Error log to see if any path errors are seen. When restoring a backup file (.ZIP), if it refers to paths witch do not exist in the server where restore is being done, be them paths defined here or paths to centralized configuration/ s, the restore may fail. One work-around in the case of servers that have centralized configurations whose paths do not exist in the server where backup is being restored, is to manually extract and copy the backup file. Note that the internal Windows archiver is NOT able to see all the paths in a backup, so it is recommended to use another archiver such as 7zip or WinRAR. Toolbar Toolbar allows you to access the most used functions quickly. All icons are default ones and cannot be changed. Icon Left arrow Right arrow Function Back to the previously visited tab. Forward to the next tab. (After the Back arrow use.) + New Click the icon and select from the list what type of account you want to create. Console will be switched into the appropriate tab. Click the icon to open the Bookmark Manager dialog to work with bookmarks. You can use the CTRL+SHIFT+B shortcut. For more details, refer to the Bookmarks Bookmark Manager chapter. Click the icon to open the File Manager dialog to work with files. You can use the CTRL+SHIFT+F shortcut. Click the icon to open the SQL Manager dialog. You can use the CTRL+SHIFT+S shortcut. For more details, refer to the System Tools SQL Manager chapter. Click the icon to open the DNS Tool dialog. You can use the CTRL+SHIFT+T shortcut. For more details, refer to the System Connection General chapter. Page 15

16 How to Import Users from Windows or AD Servers If you have user accounts already set up in a Windows or Active Directory user database, you can import these into IceWarp Server to save you re-typing them manually. To import users, select Accounts Import / Export Import Users from Windows... the following dialog will be displayed: A list of discovered users will be displayed in the left pane. Select the users you wish to import and click the Add button. When your list of users is ready, click the Import button to import the users into IceWarp Server. NOTE: Passwords cannot be retrieved from any Windows system so these will have to be entered manually. AD users must have AD authorization. The User authentication mode lets you specify the mode for all imported users. See the user account authentication mode description in the Domains and Accounts Management User Accounts User chapter. Page 16

17 How to Import Users from LDAP / Active Directory Instead of regular synchronization with a directory server, you may want to import users from LDAP or Active Directory only once. The procedure is similar to synchronization, only after the first manual synchronization, you make a bulk modification to the imported accounts to cancel the synchronization. 1. For the domain you want to import users to, temporarily set up Directory Service. NOTE: It is necessary to set all entries including those in the Advanced section. For more details, refer to the Domains and Accounts Management Domains Domain Directory Service section. 2. Click the Synchronize Now button. This action imports all accounts to the domain. 3. Imported users have the LDAP (AD respectively) authentication mode set. To change it, you can: - use command line tool to make bulk Authentication mode settings modification - or multi-select all imported users in the Management <domain> Users node, change their Authentication mode to Standard and click Save - or create a new group account, insert the whole domain as a member, under the <domain> Options tab, create a new template with the Standard authentication mode (use the Template button) and click the Apply Template button. NOTE: This way changes authentication mode of all domain accounts if you have accounts with different authentication modes, you have to change them back manually or to use the method mentioned earlier. 4. Disable Directory Services for the domain and clear all fields here. For more advanced options to import users from Active Directory or LDAP Server, please refer to the Domain Directory Services Synchronizing Users with LDAP / Active Directory chapter. Page 17

18 Import/Export Users from/to File The primary use of this function is to export and import user accounts between two IceWarp Servers. For transferring users to another IceWarp Server, we recommend to use the command line TOOL.EXE. This powerful feature lets you export accounts from the selected domain to a specially formatted text file (.MAE for version 9.x or.exp for version 10.x). The file includes all account types and account properties including its address, account name, account type (as an integer value), password and properties (as an encoded string). This file can be edited using a standard text editor. The import feature lets you import accounts from the export file. There are some important points you should be aware of: If a domain listed in the file is missing in IceWarp Server it will be automatically created. If any property values are not available, then account defaults will be used. BE AWARE: It is highly recommended that you experiment with this facility before you use it on any large number of accounts on a production server. NOTE: When exporting/importing accounts, only account structures are exported/imported. Account data is not exported/imported. If you want to backup all account data, do it manually in the IceWarp/mail/[domain]/[user] directory. To move accounts from one domain to another one, you can use the cut ant paste method. To move all domain accounts, you can just rename this domain it keeps all data intact. (When renaming a domain, all services e.g. GroupWare, AntiSpam, etc. MUST be running!) File Structure <address>,<properties> Example fred@<demo.com>,ejxjygbg4asuscxlssxkuqgtti2yhlamiwywspsokp9igah3pyoectj5ygegrb9w/w8wem5nlurmtknnzddlzs+n AYVGzEC7aWBAAwN DcW6xLigEHGDhMdBuoi9gtB5oF4yCUTAKRsHgAADS/h28 Tool.exe Commands Tool.exe is a command line interface to the IceWarp Server API from Windows. On a Linux server this will be tool.sh. To use it, navigate to the IceWarp Server installation root where it is located (usually you would type cd "/Program Files/IceWarp/" or applicable location in Linux). To export accounts, you can use this command (syntax followed by an example): tool export account "*@<domain_name>" u_backup > <file_name> tool export account "*@icewarp.com" u_backup > icewarp_com.csv To import accounts, you can use this command (syntax followed by an example): tool import account "<file_name>" u_name u_password u_comment tool import account "domain_com.csv" u_name u_password u_comment To reveal more commands, use this command (or refer to the Command Line Tool (on page 39) chapter): tool --tutorial Page 18

19 NOTE: The backup/migration file suffix is.exp but in previous versions before it was.mae. If you are exporting from an older version into.mae you can simply rename this file to.exp and it will be importable into the latest versions of IceWarp Server. Import/Export of Accounts Via Console To export accounts, do the following: 1. In the Console, right-click name of the selected domain (Domains and Accounts Management) and from the pop-up menu, select the Import/Export Export domain and account to file items. The standard Save As dialog opens. 2. Save the file e.g. as <domain_com>.exp. To import accounts, do the following: 1. In the Console, right-click name of the selected domain (Domains and Accounts Management) you want to import accounts to and from the pop-up menu, select the Import/Export Import domain and account from file items. The standard Open dialog opens. 2. Select the appropriate file to import accounts. NOTES: The domain you want to import accounts to has to have the same name as the domain that you exported accounts from. Imported accounts are added if there are any other accounts in the domain, these accounts are not deleted. It is recommended to export/import accounts only between same versions of IceWarp Server. Export of Phone Numbers You may want to export phone numbers of users of some domain. These numbers are exported into a.csv file in the following structure: Name, address, Phone number To do it, follow these steps: 1. Right-click the appropriate domain name and select the Export/Import Export Phone # to CSV items. 2. In the standard Save As dialog, select the wished location and save the file. Page 19

20 Licenses The License dialog (accessible from the main menu Help) informs about the current product registration status, allows to register a new or updated license (the Activate License button) and provides shortcuts to web interfaces where you can make license modifications (purchase renewal, add trial, add users, add modules, purchase another license, observe client activations, Manage License button) or contact sales or technical support department (Request Support button). License Registration On-line: the Activate License Online Activation tab you will need an Order ID of your license (trial or full) at hand enter the Order ID where indicated click the Activate License button. Off-line: the Activate License Enter License Offline tab you will need to obtain the new license from purchase system, Manage License License Activation, using your Order ID and the Reference ID displayed in the License dialog download the license.xml file from the web page or save the confirmation attachment to disk click Enter License to browse for the license.xml file click Open click OK. Page 20

21 License activation may fail for the following reasons: The computer is blocked from accessing the Internet or the licenseprocessor.icewarp.com server is temporarily unavailable. Enable port 80 HTTP access on your firewall for config.exe or try again later. The Order ID is not valid (the order has not been authorized yet) or it is misspelled. Verify the number, check your order status through Manage License and try again later. The license.xml file entered is issued for another computer. Retrieve a new one using the Activate License Retrieve License option. The number of license activations has been exceeded, due to registering the same license on multiple computers (there are 3 attempts to register a license during its lifespan for the purpose of server migration only, provided they do not run in parallel for more than 1 month). Use Request Support to contact Sales. The license revalidation process could not be completed neither automatically nor manually after notices sent to the system administrator and the license has been blocked and flagged for abuse. License Information The Information section shows license registration details to the left: Name, Company, and Street Address. To the right it shows the Reference ID (unique hardware fingerprint), the Order ID (identification of your license in the order database), the Previous Order ID (means that this license is an update/extension of an older license and can only be activated on top of it) and the Status of the license. Page 21

22 The Reference ID shown is specific to the machine where IceWarp Server is installed. It is generated using machine hardware and software information and as such is never the same on two machines. If you migrate IceWarp Server to a new machine, your license will no longer work and you should retrieve a new license (see License Registration). The license Status can be one of three states: OK the license is fully registered. Evaluation you are running an evaluation license or the revalidation of your full license has failed and the IceWarp Server has entered Emergency Mode (see License Revalidation); the IceWarp Server will eventually expire and stop working. Reference ID Mismatch this occurs when the license is being used on a machine that it was not issued for; in this case you should retrieve a new license (see License Registration) otherwise the services will be stopped after 7 days. The Read used seats button Click the button to refresh the Used seats counter. If you are connecting by a remote console, you need to click the button to count used license seats, while on a local server, the values are loaded immediately when you open the License dialog. NOTE: The operation can take very long time, freeze the console or timeout, depending on connectivity to the remote server, and the total number of established accounts. The Type column shows the name and category of the IceWarp IceWarp Server license. There are two categories of licenses: Server and Client. Server licenses activate the IceWarp Server (within Administration, see License Registration) and they are Communication/Security/Collaboration features. Client licenses activate IceWarp Desktop products (Desktop Client, IceWarp Outlook Sync, etc. from within their respective About dialogs, or automatically using SmartDiscover). Client licenses can also activate Mobile features which are managed from IceWarp Server Administration (SyncML, ActiveSync). NOTE: The simplified license structure (by server and client categories) is only available in the Administration Console. In WebAdmin and in tool.exe text output, you will see the license by individual Page 22

23 modules. Licenses can be listed by module also if the license was originally obtained for an earlier version. The Seats column shows the number of accounts that this license covers at the moment. You can add new system users or activate the corresponding service for additional users up to the amount shown here. The Renewal Expires column shows the number of days remaining to the expiration of the renewal period (Maintenance). If Renewal is positive, it means you can freely install any new version upgrades, update your Anti-Spam and Anti-Virus definitions and request technical support. If Renewal is negative, the product will continue to run in the same version for a lifetime, but with limited support and no security updates. A service would stop working (each midnight) only if there was a negative number of days for one module AND at the same time, the number would be different for other licensed modules (one service was not upgraded with the rest on purpose and is stopped, not affecting the others). The Used Seats column shows the number of accounts that have this service active. Only the User type accounts are counted, as only they are licensed. To list the activated accounts, double-click the service in the list of licenses. You can temporarily activate more users and exceed the amount of available Seats for a limited 14 day evaluation period. Refer to the Automatic Trial Access section (bellow) for more details. NOTE: For information about names of accounts using the service, double-click the service name. You are presented with a list of accounts. For information about client licenses, click the the Help License main menu items Manage License button. This brings you to the IceWarp shop page ( where you can obtain the information needed. Red Exclamation Mark is shown next to each license which is exceeding the number of available Seats. Access to the services for users over the limit would be disabled based on this error after a 14-day trial period. Refer to the Automatic Trial Access section for details, and see the Adjusting Used Seats chapter for how to manually adjust the system configuration to the license size. The Recommended column displays Add Users tip if the number of Used Seats is approaching the number of Seats currently available on the license, or displays Renew License tip if the Renewal Expiration is approaching (the system will also send an informative to postmaster 14 and 7 days in advance). Automatic Trial Access Beside the master Mail Server/Communication license, IceWarp lets you obtain various add-ons licensed for a lower number of users, e.g. for an initial testing before a global roll-out. By default, all services are activated for all system users which can result in the number of Used Seats exceeding the number of Seats available. Refer to the Adjusting Used Seats section to for details. If a service is enabled for a user on the Policies tab, the licenses are assigned to users who are connecting to the service from the available pool of fully licensed seats, and when no more seats are available, in a time-limited trial, which still makes them able to use that service. This way, administrators can estimate the needed size of the license before it is actually purchased. Each midnight the system compares the number of trial seats with the number of licensed seats and sends a notification to system administrator, including the list of accounts which are over the limit (using the service in trial mode). Trial period is counted from the date of first access to the service and expires 14 days after, ultimately restricting the user from access to the service. At this point you must either purchase additional seats (the Manage License button) for those users, or adjust the number of active users to the current license size, as follows. Adjusting Used Seats In the Management node, select users/domains from the middle account management tree for which you wish to deactivate this service. You can (un)select multiple users/domains using Shift+click and Ctrl+click mouse operations. Navigate to the Policies tab and within the Services pane, untick the service you are adjusting. A yellow background will appear on the Services options, reminding you that you are performing a bulk modification using the template feature. Click Save to apply the new settings (or click elsewhere to cancel). Page 23

24 Verify that the changes took effect in the License dialog. Alternatively, you can use the tool command line utility to make bulk modifications, for example the following command will disable Instant Messaging service on all system accounts, so you can then activate it only for selected accounts as outlined above: tool modify account U_IM 0 See the IceWarp API Command Line Tool chapter for more details on the tool usage. License Backup You can keep backups or snapshots of your license (applicable only to the same machine) using Help Export License and saving the license.xml file that you can later restore using Activate License Enter License Off-line the license is also saved along with the configuration using the File Backup Settings menu and restored using File Restore Settings optionally, you can manage license backup using the c_system_tools_excludelicense API variable when this variable is set to true, your license is involved into the system backup License Revalidation Revalidation is managed by the Control service and occurs periodically in time, starting from the Issue date of the license. After a defined revalidation period (approx. 1 month), the service opens a port 80 HTTP connection to and posts the current license identification. It is processed by the licensing server and a new license key is returned and transparently applied. If the revalidation is unsuccessful, the server retries the on-line revalidation each 1 hour after the previously failed revalidation attempt, and regularly sends an informative to postmaster account and license holder address (during standard retry period of 48 hours, administrator will receive the notice after 12, 24, 36 hours). The responsible person can immediately take action to either allow the outgoing connections and let the license revalidate automatically (takes no more than 1 hour), or use the Activate License Enter License Off-line option to re-enter a license previously retrieved from the website, using an XML file (Help - Export License...) or their Order ID for the same purpose. There is a 2 to 7 day (depending on type of license) grace period which defines the maximum allowed time after a failed revalidation during which the server will retry the revalidation. If it is not successful within these 2 7 days, the license status is changed to Emergency Mode. This is similar to an expired trial services continue to work, but no settings can be changed. After 7 more days the Emergency Mode expires, the event is logged into Error log, informative s are sent to postmaster, license holder and to the product's copyright holder addresses and ultimately on the next midnight, all services are stopped (and would be stopped each midnight if restarted manually). Failed revalidation: Due to a problem with connectivity, your hostname [IP] cannot connect to our license server. Please resolve the issue or validate the license via Activate License. Failed retry: Your hostname [IP] could not revalidate the license with our license server. As a result, your license has been forced into Emergency Mode. Please fix any existing connectivity issue or validate the license manually via Activate License. If the license is not validated, the services will be discontinued after a short grace period. Expired Emergency Mode: All attempts to validate the license failed. As a result, the services will be stopped. SYSTEM [A000] 22:32:07 All attempts to validate the license failed. As a result, the services will be stopped. SMTP Traffic Limits SMTP outgoing queue processing is delayed for low user licenses and high traffic, receiving works normally. The mechanism considers amount of incoming and outgoing s to non-local accounts per day with relation to the number of licensed users. If the number of outgoing connections exceeds a threshold, sending out will be postponed for some time, until the levels balance or 12 AM. The limitation never occurs for 50+ user license, so it typically only occurs for less than 50 user licenses. This prevents using low user licenses as filtering gateways and for large mailing lists. An event is logged into SMTP log whenever a session is delayed. SYSTEM [05D4] 19:05:27 Client session Traffic delay applied Page 24

25 WebAdmin IceWarp WebAdmin is the web-based interface for IceWarp Server administration. Please be aware of its limitations compared to other administrative tools: WebAdmin cannot execute programs, stop Web/Control service without disconnecting you, it provides only basic charting/statistics and some advanced setup options are not implemented. For comprehensive remote server management, consider the following tools: Remote Connection from Administration GUI application, more details in the Remote Server Administration chapter. Administration GUI including Remote Console also runs in Wine on Linux. More details can be found in the Linux Quick Guide and in Support Knowledge Base ( The command line interpreter tool.exe or tool.sh for direct API access, more details in the IceWarp Server API chapter. Linux wizard script./wizard.sh which provides basic operations on account, storage and license management. More details in Installation and Control in Linux guide. Working with WebAdmin is very easy because the design of the options is very similar to the one you know from IceWarp Server Administration Console. There is context sensitive help available for all screens in WebAdmin, simply click the blue (?) button located in the right top corner. Page 25

26 You can access WebAdmin at: or, if not using the default port: or or respectively. Example If you are running the Control service on the default port 80 and you have your server installed on a computer with IP address you can access WebAdmin at Additionally, you can set a new web service host on your IceWarp Server to access the WebAdmin at a defined URL, e.g. You should create such a host also in your DNS pointing to your IceWarp Server's IP and in the website definition, in the Web node of the console, set the home directory to html\admin. Page 26

27 WebAdmin respects the extended access rights that you can specify in Management User Permissions Rights Advanced. This way you can limit access of domain administrators to only specified domains, set which particular account types the administrator can modify and hide administrative options they should not be able to access. Page 27

28 WebAdmin Customization Tooltips You can customize tooltips text, insert images and links into them, etc. In the user.xml file (IceWarp\html\admin\xml\accounts\), add the following parameters: tooltip the appropriate alang identifier. Find it in the alang.html file (IceWarp\html\admin\lang\[language_code]\). tooltipheight, tooltipwidth tooltip box size in pixels. For example: <OPTION type="password" name="user_password" tooltipheight="90" tooltipwidth="224" tooltip="tstrings_wa_comment_pwd" function="user_password" label="tframeaccounts_passlabel"/> In the alang.html file, add html tags to modify a tooltip text. NOTE: You have to use HTML special chars within a tooltip string. (< for < etc.) Also, use ' (apostrophe) instead of " (quotes) src=' for src=" To convert usual HTML chars to special ones, use this link: Example: $alang["tstrings_wa_comment_pwd"] = "Type your <b>password </b> <img src=' width='80' />"; Users that have accounts only within backup domains obtain only quarantine reports. There is a way how they can access their quarantine queues without necessity to wait for reports. They have to: * Insert the following address into a browser address field: <icewarp_server_hostname>/admin/index.html?view=gateway_login * Fill in the Address and Captcha fields. Page 28

29 * Follow the shown link to their current quarantines. The link is sent to the appropriate mail box. Page 29

30 API Console This tool lets you manage values of API variables. There are four possibilities how to launch the API console window: Select the File API console main menu item only system API variables are shown. Select the Accounts API console main menu item API variables of the selected domain/account are shown. Right-click a domain name and select the API console item domain API variables are shown. Right-click a single account (specific user, group, mailing list, etc.) and select the API console item account API variables are shown. Field Filter Export Import Description Write an expression (or a part of it) you want to search for. You can search for values from all three columns. To reveal all variables, clear the field and hit Enter. Click the button to export (import respectively) API variables values. Usual Save As (Open respectively) dialog is shown. Recommended file formats are.cvs and.txt, but other ones are also possible. NOTE: When filtering performed, only shown variables are exported. Right-click the selected variable to manage it. Page 30

31 Item Toggle Modify Copy Name/Value Description Applies to boolean values. Toggles them true/false. Applies to string values and integer ones. Dialog for change performance is shown. Click the item to copy the name of the selected variable (value respectively) into your clipboard. NOTE: Some values are not changeable Modify/Toggle items are not enabled. These values are set within installation (version, timezone,...) or determined from the current state (mailboxsize) etc. NOTE: When seeing boolean values, they represent either a 1 or 0. If set to 1, it means the option is enabled and 0 means disabled. NOTE: The API console does show exact variable names. To obtain its exact name, right-click a variable within the console and select the Copy Name item (or search for this variable within the apiconst.pas file (<install_dir>/api/delphi/)). Page 31

32 Miscellaneous Find Dialog The Find dialog can be used to locate accounts within your IceWarp Server. Select Accounts Find (or just hit the Ctrl + F keys) the following dialog opens. Field Account: (Alias, Name, Description) Domain: (Name, Description) Account type Description Specify a string you wish to locate in the account name, alias or account description. AND/OR > Specify part of the domain name or the entire name to find it. Domain description can be searched for as well. NOTE: You can search also for strings within the Description fields of all server domains. However, this feature cannot be used for the Description fields of any account types. Select an Account type if you wish to limit your search to a particular account type. E.g.: In the above screenshot we are looking for User accounts with the string of "alison" in the account name AND the string of "icewarpdemo.com" in the domain name. Find Click the Find button and your criteria are used as a filter. Selecting the Management node shows a tree only with accounts which comply with the filter. NOTE: If you want to view all domains (users, groups,...) again, you have to press the F5 key. (Another way is to repeat search with searching criteria cleared.) Status Bar The Status Bar is located at the bottom of the GUI. Page 32

33 Field Advanced Basic <Language> Navigation bar Description Interface mode switch. Click this button if you want to have all nodes of the server tree shown. Interface mode switch. Click the button if you want to have the server tree simplified. Only the first level nodes are shown. Some sub-nodes (e.g. Global Settings) are not accessible. Select the GUI language here. English is currently selected. This bar shows what tree node is currently selected. The SMS Service node here. NOTE: Information about a server version is placed above the Main Menu bar. Languages IceWarp Server is in English by default but it can be localized to other languages by loading a language xml file. Various language files are available but you can also write your own if you wish. The language file to be used at startup can be specified in file info.xml or you can switch between languages using the language list (see above). It will expand to show all available language files. Select one and the interface will immediately start to use that language. The language XML files have to be located in the <install_dir>/xml/lang/<language_abbreviation> folder and each XML file should have a language identification tag as the first line. For example: the Portuguese language file is called data.xml, is placed in the <install_dir>/xml/lang/pt directory, contains the console translation and should look like this: <?lang caption="portuguese" abbr="pt" translator="pele" contact="[email protected]" langversion="1.5" version="8.2.2" date=" "?> <?xml version="1.0" encoding="utf-8"?> <APPLICATION><FORMS><FORM ID='TConfigForm' CAPTION='Administração do IceWarp Server'><ITEM ID='AccountsSheet' CLASS='ttabsheet' CAPTION='Contas'/> <ITEM ID='AccountsDomainSheet' CLASS='ttabsheet' CAPTION='Contas de domínios'/> <ITEM ID='UserGroupsSheet' CLASS='ttabsheet' CAPTION='Grupos de Usuários'/> <ITEM ID='AccountGlobalSheet' CLASS='ttabsheet' CAPTION='Configurações Globais'/> <ITEM ID='AccountDefaultsSheet' CLASS='ttabsheet' CAPTION='Contas'/> <ITEM ID='AccountDefaultsGroupBox' CLASS='tgroupbox' CAPTION='Padrões de contas'/>... Node Tree Search This search feature allows you to filter administrative console nodes and subnodes. Page 33

34 Write the desired term or its part into the Search field (at the top of the tree pane). Nodes and subnodes are filtered immediately. To reveal all nodes, just clear the Search field. NOTES: Search keywords are used for each node/tab. I.e. it is not necessary the appropriate tab (in GUI) includes exact expression you have searched. If some node is found, all its subnodes are shown too. Copy Button On the various places in GUI, you can find the Copy button. It is used on places where you add multiple items (together with the Add, Edit and Delete buttons). It copies the currently selected item and presents the Add dialog with the items values. This lets you easily duplicate and alter any item in the GUI, no matter if it is a SIP gateway rule, Web service or a simple SSL tunnel item. You do not need to use the copy & paste feature anymore. Live Assistant This feature helps you to connect easily with IceWarp Server support. Available only for IceWarp Server trial versions. Account Colors User account are distinguished by icon colors: Page 34

35 Permissions Administrator Domain administrator Standard user Disabled/expired account Color Red Green Grey Dimmed Shared Topics This chapter contains topics that are common to more chapters. So there are links to appropriate sections instead and such sections are stored in this chapter to decrease the greater size which could be caused by reusing them on more places. Page 35

36 DNS Records Configuration A Records Active Sync For smooth functioning of Auto/SmartDiscover mechanism, it is necessary to configure A DNS record. There are two ways how to do it: You can either set this record directly: autodiscover.<domain.com> <IP_address> where IP_address is the address of the "main" server. Or better you can set A record only for this "main" server + set a CNAME record (alias): autodiscover.<domain.com> <server.domain.com> This way saves a lot of work in the case IP address of the "main" server is changed and you have set many aliases instead of many A records. SRV Records WebDAV For Apple CalDAV/CardDAV clients you need to configure DNS records otherwise they will not be able to connect. Also if the hostname is different to the domain name, then a DNS SRV record should be configured to point to the actual hostname. NOTE: If the hostname is different to the domain, then a DNS SRV record should be set up by the domain owner. The syntax of SRV records for standard HTTP (port 80) and HTTPS (port 443) access: _caldav._tcp.<domain> IN <Host> _caldavs._tcp.<domain> IN <Host> Where Domain is the domain to be contacted and Host is the actual host, so if you are the owner of domain icewarpdemo.com and you are running your IM server as im.icewarpdemo.com you should create a DNS SRV record as follows: _caldav._tcp.icewarpdemo.com IN SRV im.icewarpdemo.com NOTE: This full record form is to be used when you want to edit a zone file directly. When using any interface, just fill in the appropriate fields. The same applies for CardDAV: _carddav._tcp.<domain> IN <Host> _carddavs._tcp.<domain> IN <Host> i.e.: _carddav._tcp.icewarpdemo.com IN SRV im.icewarpdemo.com These records are necessary for Apple clients (ical and Address Book in Mac OS X 10.6 and later). Without these records, the client applications will be unable to find location of the WebDAV service. (Searching algorithm prefers this SRV record information, if available. If not, the client tries to connect to the specified server using the following ports: 8800 (CardDAV), 8843 (CardDAV + SSL), 8008 (CalDav) or 8443 (CalDAV+SSL)). It is probable that other clients will follow this trend. SIP Page 36

37 Syntax for SIP is as follows: _sip._tcp.<domain.com> _sip._udp.<domain.com> _sip._tls.<domain.com> Other parts are same. XMPP Syntax for XMPP is as follows: _xmpp-server._tcp.<domain.com> _xmpp-client._tcp.<domain.com> Other parts are same. Page 37

38 Simple RegEx Tutorial Regular expressions can be used in content filter conditions. Regular expressions can be extremely complex but they are very flexible and powerful and can be used to perform comparisons that cannot be done using the other checks available. Some very basic examples of regular expression usage follow. For a complete description, please visit ^' and '$' First of all, let's take a look at two special symbols: '^' and '$'. These symbols indicate the start and the end of a string, respectively: "^The" "of despair$" "^abc$" "notice" matches any string that starts with "The". matches a string that ends in with "of despair". a string that starts and ends with "abc" effectively an exact match comparison. a string that has the text "notice" in it. You can see that if you do not use either of these two characters, you are saying that the pattern may occur anywhere inside the string you are not "hooking" it to any of the edges. '*', '+', and '?' In addition, the symbols '*', '+', and '?', denote the number of times a character or a sequence of characters may occur. What they mean is: "zero or more", "one or more", and "zero or one." Here are some examples: "ab*" "ab+" "ab?" "a?b+$" matches a string that has an 'a' followed by zero or more b's ("ac", "abc", "abbc", etc.) same, but there is at least one b ("abc", "abbc", etc., but not "ac") there might be a single b or not ("ac", "abc" but not "abbc"). a possible 'a' followed by one or more 'b's at the end of the string: Matches any string ending with "ab", "abb", "abbb" etc. or "b", "bb", etc. but not "aab", "aabb", etc. Braces { } You can also use bounds, which appear inside braces and indicate ranges in the number of occurrences: "ab{2}" "ab{2,}" "ab{3,5}" matches a string that has an a followed by exactly two b's ("abb") there are at least two b's ("abb", "abbbb", etc.) from three to five b's ("abbb", "abbbb", or "abbbbb") Note you must always specify the first number of a range (i.e., "{0,2}", not "{,2}"). Also, as you might have noticed, the symbols '*', '+', and '?' have the same effect as using the bounds "{0,}", "{1,}", and "{0,1}", respectively. Now, to quantify a sequence of characters, put them inside parentheses: "a(bc)*" "a(bc){1,5}" matches a string that has an 'a' followed by zero or more copies of the sequence "bc" one through five copies of "bc." ' ' OR operator Page 38

39 There is also the ' ' symbol, which works as an OR operator: "hi hello" "(b cd)ef" "(a b)*c" matches a string that has either "hi" or "hello" in it a string that has either "bef" or "cdef" a string that has a sequence of alternating 'a's and 'b's ending in a 'c' ('.') A period ('.') stands for any single character: "a.[0-9]" "^.{3}$" matches a string that has an 'a' followed by one character and a digit a string with exactly 3 characters Bracket expressions Specify which characters are allowed in a single position of a string: "[ab]" "[a-d]" "^[a-za-z]" matches a string that has either an 'a' or a 'b' (that is the same as "a b") a string that has lower case letters 'a' through 'd' (that is equal to "a b c d" and even "[abcd]") a string that starts with a letter "[0-9]%" a string that has a single digit before a percent sign ",[a-za-z0-9]$" a string that ends in a comma followed by an alphanumeric character You can also list which characters you DO NOT want just use a '^' as the first symbol in a bracket expression (i.e., "%[^a- za-z]%" matches a string with a character that is not a letter between two percent signs). In order to be taken literally, you must escape the characters "^.[$() *+?{\" with a backslash ('\'), as they have special meaning. On top of that, you must escape the backslash character itself in PHP3 strings, so, for instance, the regular expression "(\$ A)[0-9]+" would have the function call: ereg("(\\$ A)[0-9]+", $str) (what string does that validate?) Just do not forget that bracket expressions are an exception to that rule -- inside them, all special characters, including the backslash ('\'), lose their special powers (i.e., "[*\+?{}.]" matches exactly any of the characters inside the brackets). And, as the regex manual pages tell us: "To include a literal ']' in the list, make it the first character (following a possible '^'). To include a literal '-', make it the first or last character, or the second end point of a range." Command Line Tool There is a completely new command line tool which you can use to administer domains and accounts as well as all system variables. This tool is called tool.exe and you can find it directly in the <InstallDirectory> folder. For Linux, this is called tool.sh. It is easy to use and you only have to know the API constants. Complete list of API constants is in the APIconst.pas file in the <InstallDirectory>\API\Delphi\ folder. NOTE: Using tool.exe for performing large operation can cause temporary service unavailability because the service needs to be restarted for some changes in configuration. For servers with many domains and many users with high load, restarting can take some time. Therefore, we recommend performing large batches of changes in low-load periods. NOTE: Command line tool does not support multi-line you can encounter this e.g. using the autoresponder variable. Page 39

40 Command CREATE DELETE MODIFY DISPLAY EXPORT FILE Description Creates a new object. It is followed by a type (domain or account) and a list of variables and values you want to assign to these variables. Deletes an object. It is followed by a type (domain or account) and a unique name of object you want to delete. Modifies any variable (property) of an object. It is followed by a type of object and a list of variables and values you want to assign to these variables. Displays any variable (property) of an object. It is followed by a type of object (domain, account or system) and a list of variables you want to show. Result is generated with double line feeds. Does the same as DISPLAY command but this command shows on the screen everything separated by comma (CSV format). Result is generated without double line feeds. Calls file functions. It is followed by USERSTATISTICS and all its parameters (see below). Parameter ACCOUNT [variables] DOMAIN [variables] SYSTEM [variables] BATCH batchfile USERSTATISTICS fromdate todate filterstring outputfile Description Address any account on the server. Address any domain on the server. Address any system variable such as c_version, c_name, etc. List is also in APIConst.pas Allows you to run a batch file with a set of commands included. See examples below. Batchfile is just a common text file with commands. Each on a separate line. These commands must not include "tool" at the beginning. Just the commands and parameters. Saves user statistics between fromdate and todate to specified output file for all users that fulfill the condition of filterstring. fromdate, todate have yyyy/mm/dd format filterstring supports also asterisks and question marks to specify more accounts. If it does not symbol it is considered as domain name. outputfile if you do not specify absolute path, it will be saved to the <InstallDirectory> folder. How to create other types of accounts To do this, you have to use the u_type property. Its values are also written in the APIConst.pas file. For example mailing list has 1 as a value of this property. So if I want to create mailing list, I will have to use this: tool create account [email protected] u_type 1 m_owneraddress "[email protected]" Usage tool create account [email protected] u_name "New Account" u_password "pass" u_accounttype 2 It creates an account with New Account in Full Name field and pass as password. tool display account [email protected] u_mailbox u_accounttype It shows you values of both variables of u_mailbox and u_accounttype of the [email protected] account. tool delete domain oldone.net It deletes the oldone.net domain from your server. Page 40

41 tool modify account u_accounttype 2 It changes all accounts in icewarpdemo.com to IMAP accounts. tool file userstatistics 2004/12/ /12/31 icewarpdemo.com statistics.txt It saves user statistics between dates 2004/12/25 and 2004/12/31 for all accounts in icewarpdemo.com domain to the statistics.txt file. This file can be found in the <install_dir> folder. tool export domain * d_description d_postmaster It shows on the screen the d_description and d_postmaster variables for all domains in CSV format each value is separated by comma. tool export account *@* u_mailbox u_name u_password > accounts.txt Besides exporting the three above fields, it also puts user's full address into the first column. tool import account contas.txt u_name u_password Imports three fields from CSV. NOTE: The first field imported from this CSV file is an address it is imported automatically and is not to be written in the import command. It has to be specified in CSV in the first place. tool display system c_config_services_pop3_port It shows the system variable that contains a POP3 service port. tool file batch create_mailing.txt where create_mailing.txt looks like: create account [email protected] u_type 1 m_owneraddress "[email protected]" create account [email protected] u_type 1 m_owneraddress "[email protected]" create account [email protected] u_type 1 m_owneraddress "[email protected]" It creates three mailing lists defined in the create_mailing.txt file. tool check account *@* passpolicy It verifies which accounts do not comply with the new password policy. tool check account *@* passpolicy > <filename> It redirects to a file. Example: tool check account *@* passpolicy>outofpolicy.txt tool display > accounts.txt Gets a listing of accounts with double line feeds. tool export account *@* > accounts.txt Gets listing with single line feeds. NOTE: Passwords can contain special chars. All quotes are prefixed with backslashes. If there is a comma in a password, this password is quoted. Page 41

42 php.user.ini Advantages IceWarp Server uses the php.ini file. This file is used to store php settings. After every server upgrade, this file is overwritten. It means that any changes performed before upgrade are lost. It can be annoying to do these changes again and again. To ease your work, you may want to use the php.user.ini file. When placed in the same folder as the php.ini file, content of the php.user.ini file is attached automatically to the php.ini one during server upgrade. The later occurrence of the same setting is used. This means that you can insert all changes performed against the original php.ini file into the php.user.ini one that is not overwritten during upgrade and the server will use these changed settings. Example Part of the original php.ini file:... extension=php_pdo_odbc.dll ;extension=php_pdo_mysql.dll ;extension=php_mysql.dll ;zend_extension_ts = "ext\php_xdebug.dll" ;extension=php_bz2.dll ;extension=php_ctype.dll ;extension=php_cpdf.dll ;extension=php_curl.dll... Part of the php.user.ini file:... extension=php_pdo_mysql.dll extension=php_bz2.dll... Part of the php.ini file after upgrade:... extension=php_pdo_odbc.dll ;extension=php_pdo_mysql.dll ;extension=php_mysql.dll ;zend_extension_ts = "ext\php_xdebug.dll" ;extension=php_bz2.dll ;extension=php_ctype.dll ;extension=php_cpdf.dll ;extension=php_curl.dll... extension=php_pdo_mysql.dll extension=php_bz2.dll... Page 42

43 The uncommented extension=php_bz2.dll setting is used because of its later occurrence.php BE AWARE: Do not copy the whole php.ini to the php.user.ini file! From the php.ini file, copy only lines you want to have uncommented, paste them to a new file and uncomment them. Otherwise, you can encounter problems with PHP (and, consequently, webmail). Page 43

44 snmp-mib.txt File snmp-mib.txt File This file includes several sections of variables. Some of them are defined in SNMP and/or MIB. For more information, refer for example to The current version of this file is available in <install_dir>\doc\snmp-mib.txt. In the SvcID section, there are variables defined by IceWarp: Variable Statistic Item Description 1 - svcname Service Service name 2 - svcrunning 0 not running 1 - running 3 - svcuptime Running Time Service running time 4 - svcserveroutdata Server Data Out Amount of data sent out during server sessions (In kb) 5 - svcserverindata Server Data In Amount of data received during server sessions (In kb) 6 svcclientoutdata Client Data Out Amount of data sent out during client sessions (In kb) 7 - svcclientindata Client Data In Amount of data received during client sessions (In kb) 8 - svcserver Server Connections (Count) Actual number of concurrent server sessions 9 - svcserverpeak Server Connections (Peak) Maximal number of concurrent server sessions 10 - svcclient Client Connections (Count) Actual number of concurrent client sessions 11 - svcclientpeak Client Connections (Peak) Maximal number of concurrent client sessions 12 - svcserverconns Connections Total Number of all historical sessions (client + server) 13 - svcpeakworkingsetsize Working Set Size Peak Maximal amount of memory used by the service 14 - svcpagefileusage Number of page file used by the process (process statistic Windows tells us this) 15 - svcworkingsetsize Working Set Size Current amount of memory used by the service 16 - svcsmtpmessageout Sent All following variables are related to SMTP service. Number of messages send out from the server 17 - svcsmtpmessagein Received Number of messages received by the server 18 - svcsmtpmessagefailed Failed Number of failed messages during sending 20 - svcsmtpfailedvirus Virus All following variables are related to incoming messages. Number of failed messages with a virus recognized 21 - svcsmtpfailedcf Content Filter Number of failed messages filtered by content filters 22 - svcsmtpfailedstaticfilter External Filter Number of failed messages filtered by external filters 23 - svcsmtpfailedbwfilter Rules Number of failed messages filtered by rules 24 - svcsmtpfaileddnsbl DNS Number of sessions filtered by features within the Mail Service Security DNS General section 25 - svcsmtpfailedtarpit Intrusion Prevention Number of failed messages braking intrusion prevention rules Page 44

45 26 svcsmtpfailedspam Spam Marked Number of messages evaluated as SPAM and accepted (does not include rejected SPAM) Access Mode Policies Access mode for individual services is set on both domain and user levels: Upon the [domain] Policies tab (Domains and Accounts Management) for domains. Upon the [user] Policies tab (Domains and Accounts Management [domain]) for users. Page 45

46 Bypassing Rules/Filters To enhance capabilities of IceWarp Server, increase its performance and ease administration, it offers possibility to use bypassing. You can find it on many places e.g. within Anti-Spam, Anti-Virus, Content Filters, etc. It allows you to bypass rules/filters processing for certain senders, recipients, domains, addresses, etc. Click the "B" button to specify a bypass list. In the Bypass dialog, you can specify the bypass items. Use the Add and Edit buttons to create/edit a record. The Bypass Item dialog opens: Field Type Description Select the bypass item type. For the list, see the Value feature description. Page 46

47 Value Fill in or select the appropriate value for bypass item types: Type All (= Sender, Recipient, IP Address) Sender Recipient Local Sender Trusted Session DNS A IP/Pattern DNSWL File Value (Explanation) address, domain, IP address address or domain address or domain leave the Value field blank ( s of all local senders will bypass rules/filters processing) leave the Value field blank ( s of all authenticated users or users connected from trusted IP will bypass rules/filters processing) sever hostname IP address that you can find in the SMTP log of the senders connection. You can use wild cards and bitmasks. E.g *.* or /24 a name of the DNSWL server that you trust/use, for more DNSWL servers create more bypass records path to the bypass file with defined bypass items; e.g. c:\data\bypass\allbypass.dat Comment Enter bypass description. Use the Delete button to remove the selected record. Click the Text File button to reveal the editable text file with current records. To reveal syntax rules, click the Comment button here. Page 47

48 Database Settings The Database dialog lets you specify the database, connection details, create and drop tables and perform a connection test. Field Primary Connection Backup Connection Description This field specifies the complete connection string to the database source. Enter the database name, server name, username and password for your database (your DB administrator should be able to provide these). The file browser button to the right of the Database field is only active if SQLite or Firebird are chosen. SQLite is a file based database, and you can use the file browser to select explicitly the file containing your database. When using Firebird, there are two possibilities: The database is placed on the same (local) machine fill in the Database field and leave blank the Server one. The database is placed on a remote machine fill in both Database and Server fields. For the Server field, use the usual syntax server(:port). The backup connection string serves as a backup solution in the case the primary connection cannot be used. It has the same format as the primary connection. The file browser button to the right of the database field is only active if SQLite is chosen. SQLite is a file based database, and you can use the file browser to select explicitly the file containing your database. Each time a DB query should be performed, following logic is used: If the DB connection is KO and it was a primary connection, try backup connection. If the DB connection is KO and it was a backup connection, try primary connection never do a loop! If the DB connection is OK and it is a backup connection older than 5 minutes, destroy it and create a new connection. This new connection will be created using primary DB if possible. NOTE: IceWarp Server sends data only to one database. In the case your primary connection is available, data are sent only to your primary Page 48

49 database. Backup to your backup database has to be set on your backup server. If the primary connection is down, data are sent only to your backup database. NOTE: In the case you use backup connection, you have to set database replication. IceWarp Server does not do it by itself, this replication has to be set on your database server. Database Syntax Choose the database type that corresponds to your database from the drop-down list. Supported database types are: MySQL SQLite Microsoft SQL Oracle Firebird InterBase Microsoft Access Database Driver Choose the DB driver that corresponds to your database. ODBC will work with all databases except for: MySQL select MySQL SQLite select SQLite Firebird select Firebird NOTE: When configuring Oracle database driver, do not tick the Enable Statement Caching option. Caching on the Oracle server is powerful enough. Database History Select a DB connection string from the list of previously used ones. Buttons Field Create Tables Drop Tables Test Connection Description This button creates the required tables in the ODBC source. You have to create the right tables for every ODBC source. Click this button to delete created tables from the ODBC source. Always perform the ODBC connection tests. If the test is successful, you have set all the information properly. If not, you have to make changes. Page 49

50 Step by Step 1. Create a System DSN in the Control Panel Administrator Settings ODBC Data Sources to connect to your DB. Make sure it is a System DSN and not a User DSN. 2. Fill in the proper connection string. Specify a backup connection if required. Test connection use the Test Connection button. 3. Create tables using the Create Tables button. 4. Click the OK button. REMEMBER that IceWarp Server is a 32bit application, therefore it will not work with default x64 ODBC driver on 64bit OS. Run the 32bit Data Sources (ODBC) odbcad32.exe application located in WINDOWS\Syswow64 to set DSNs of IceWarp Server on 64bit system. 32bit and 64bit ODBC DSNs are being stored separately. If you use 64bit IceWarp Server, it is necessary to add the 32bit version of libmysql.dll to WINDOWS\Syswow64. Supported Databases IceWarp Server always supports only official/stable releases of database engines: ships with SQLite native support supports MySQL versions up 5.1 and 5.5 via native driver supports Firebird 2.1 via native driver supports MS Access 2008, MS SQL 2005/2008, Oracle 11, InterBase, using ODBC or unixodbc (check version support with ODBC driver vendor). IceWarp recommends using MySQL, Microsoft SQL or Oracle for large installations as these are more robust and capable of handling the increased traffic. Page 50

51 Database Charset All databases, i.e. AntiSpam GroupWare WebClient PDO Accounts should use the UTF8 character set. IceWarp Server uses UTF8, if any its database is set to use other character set (usually by default they use LATIN1) it causes issues. NOTE: If you have used a database (created in MySQL as latin1) from an old IceWarp Server installation to a fresh installation (set to use UTF-8 for driver connections), you may experience problems with viewing data in the console, WebClient, etc. diacritics shown incorrectly. If this happens, migrate your data to UTF-8 (check MySQL manual) or, an easier way to get around, use API to change connection to use latin1. So: tool modify system C_System_MySQLDefaultCharset latin1 makes it to use latin1 instead of UTF-8. Path Variables for MySQL and FireBird When using either MySQL or FireBird databases, you have to take into account that these databases use own libraries installed into specific folders: C:\Program Files\MySQL\bin for MySQL C:\Program Files\FireBird\bin for FireBird You have to use these folders and add the appropriate path to the system Path variable (Control Panel System Advanced system settings Advanced Environment Variables System Variables) use semicolons to separate single paths. BE AWARE: Do not use different folders for these libraries as you could forget to upgrade them after database server upgrade! NOTES: You may need to reboot the server after the Path variable change this depends on the OS you use. The WebClient and GroupWare databases have to be case INSENSITIVE! Otherwise, WebClient will not work properly. Page 51

52 Database Security Basics A short word on DB security. What you should be aware of: 1. Always run the DB engine under a user with limited system rights (do not use the system user). 2. Always use different databases for different engines (accounts, Anti-Spam, GroupWare they all should use different databases). 3. Use up-to-date server version with SQL injection protection (9.4.2 and higher). 4. Pay special attention when running MySQL it supports a special clausule which allows the query to be saved to a file (SELECT... INTO FILE file.txt). This means that when a hacker can inject the SQL statement they can save anything to a file which then can be accessed via HTTP (do the maths, insert PHP script and you are in). But if you follow 1) and 2), you do not need to be worried ever. The most important part is to run MySQL (or other) under a user which has write access rights only to the directory of the database. It is a common sense on Linux but Windows users often do not realize this. IceWarp Server Databases Database Types A. Accounts used for accounts information, critical for an administrator to be able to log into a console. B. Directory cache keeps records of the folder structures of the mail storage. C. GroupWare used to store all events, tasks, notes, contacts, etc. basically all user data except mails. D. ActiveSync (EAS) used by EAS server as metadata storage, essential for synchronization to work. When lost, all devices will go for a full re-synchronization. E. AntiSpam used to store users' blacklists and whitelist. F. AntiSpam reports used by challenge script which generates qurantine/antispam reports for users. G. WebClient serves as cache for WC, keeps records of folders and mails (basically metadata) together with flags (colored ones). When lost, colored flags are gone (IMAP flag will remain). Server will have to generate new cache for each user, can be very resource demanding at early stages after loss. What Happens when DB Is Unreachable (or Lost) A. Accounts server will not recognize accounts so neither mail acceptance nor login will work. Domains/accounts will not be present in the administration console. This is a serious problem on Linux machines where remoteconfig has to be used. In such a case, administrators have to enable remote login using the tool.sh or wizard. Example on tool.sh [root@durotar icewarp]# sh tool.sh create account [email protected] Account [email protected] created. [root@durotar icewarp]# sh tool.sh set account [email protected] u_password Secret1 u_admin 1 Account [email protected] updated. Account-save problem most probably indicates that password does not meet password policy set on server. Mail storage is unaffected by loss of this DB, therefore if account with same primary alias is created mails are again available to that account. B. Directory cache when lost, server performance will be dramatically lowered, which will cause terrible user experience. The same will happen when mail storage path (u_mailboxpath) is set outside of the scope of default mail storage path defined in storage section of admin console (this must be fixed using thge externaldirs.dat file). When lost, re-index should be scheduled immediately, however admin should be aware that the process can take a lot of time to complete (depends on # of accounts and directories on storage). When the cache is not available, IMAP will not return all directories (in IMAP terminology mailboxes) when the xlist command is issued. C. GroupWare when lost, GW data will not be present no calendar events, notes, tasks, etc. (mails are not affected). GroupWare service indicates this state in logs. Page 52

53 D. ActiveSync as stated before, this DB holds synchronization metadata as well as devices and their settings, ABQ mechanism uses this DB as well = when lost, all EAS setting will be doomed, all clients (mobile devices mostly) will go for full resynchronization as record of synchronization keys will not match. Users will hate admin, because full synchronization can take hours (especially for users who have a lot of GW data and/or s (as managers usually do)). E. AntiSpam when lost, user Black List/White List will not be accessible/applied. F. AntiSpam reports challenge script will not work therefore reports will not be sent, this can be easily discovered in logs. G. WebClient when lost, the server will generate a new DB on user login to WebClient. If there are hundreds of accounts logging at same time (e. g. when users start to work), server storage performance can be significantly decreased. There are two types of flags IMAP flags (red flags) and WC flags (colored ones). When this DB is lost, colored WC flags are lost, this is not a big deal, but it can have destructive effect on somebody's workflow. IMAP flags are handled by IMAP so unaffected by loss of this DB. Best Practices Always use adequate DB engine (not SQLite) for GroupWare. It is better to keep databases split do not use one for everything. Accounts are essential especially on Linux with remote config so better keep them separate, GroupWare and WebClient should be separate too, dircache + EAS, AntiSpam + reports can go together. Supported DB Engines Reports and EAS are limited to SQLite and MySQL only. WebClient is limited to MSSQL, MySQL, Oracle and SQLite (per user or per server). The rest can use all we support. Best functionality offered at current product state is with MySQL. Migration What Do You Need to Know? There can be issues when migrating from SQLite to any other Db engine. SQLite does not respect column type definitions (it can store more characters than allowed, null is empty string). Most issues can be overcome by altering table definition in calendar.xml. Sometimes few records have to be located using query and updated in the same way IceWarp Server's SQL manager can help with this. Migration of WebClient DB Migration should be made without client sessions opened, in order to force that, stop control service, delete session data from php/temp, disable access to webmail (you can use firewall to block access temporarily) and then start the migration. When migrating this DB, loss of entries with colored flags can occur. This is not a problem on servers where these are not used as missing entries in cache will be automatically added by webmail when users log into WebClient. Cache size and number of colored flags used can be measured by attached script compare results before migration and after it. Extract the cache_meter.zip file under the html/ folder and access it via a web browser. No need to configure anything as the script reads DB settings in similar way as WebClient does. There is more information in the readme.txt file. Tips and Tricks MySQL is not configured when installed, every admin should check server workload and adjust settings accordingly. MSSQL works fine, but sorting/searching can cause problems with national characters. Firebird is more experimental and will be abandoned as well as SQLite in upcoming versions, most probably since Oracle suffers from lack of support of national characters in current implementation of our product (English is fine). WebClient Tips and Tricks Do not use database engine for the cache unless you have server with sufficient resources (especially RAM) to hold the database. Be aware that cache is growing steadily. Also, the DB engine will need a proper configuration (this is usually problem with MySQL). Moving to DB server can lower load put on mail server's storage or can free a considerable space on storage. If you use a single DB for all users, deleted account data will persist in cache after deletion. This problem can be solved either by the attached tool (wccm-2_3.zip) and its functionality called Cache Cleaner or running a following queries: Page 53

54 DELETE FROM item WHERE folder_id IN (SELECT folder_id FROM folder WHERE account_id LIKE :accountid; DELETE FROM folder WHERE account_id LIKE :accountid; Where :accountid is a placeholder for full account which you must know. WCCM tool will find all orphaned cache entries for you. Page 54

55 Server Variables The following table describes the server variables you can use at certain places within the system. Please be aware that not all variables are applicable or available for all areas of the server. Variable %%From%% %%From_ %% %%From_Alias%% %%From_Domain%% %%From_Name%% %%To%% %%To_ %% %%To_Alias%% %%To_Domain%% %%To_Name%% Returns whole From header of the message first address from the From header alias part of the first address from the From header domain part of the first address from the From header name taken from the From header; (performed as string before the first < character) whole To header of the message first address from the To header alias part of the first address from the To header domain part of the first address from the To header name taken from the To header; (performed as string before the first < character) %%Sender%% sender of the message (whole content of MAIL FROM: command, even with < and >) %%Sender_ %% address of the sender (without < and >) %%Sender_Alias%% %%Sender_Domain%% %%Recipient%% %%Current_Recipient%% %%Recipient_ %% %%Recipient_Alias%% %%Recipient_Domain%% %%Extension%% %%ExtensionNoSep%% %%Subject%% alias part of senders address domain part of senders address list of all recipients delimited with semicolon ((whole content of RCPT TO: commands, even with < and >) address of the current recipient - the address of the account being processed address of first recipient of the message alias part of address of first recipient of the message domain part of address of first recipient of the message. If empty, primary domain is returned. Extension of the recipient address containing the extension separator Extension of the recipient address without separator Subject of the message %%Message-ID%% Message-ID of the message (even with < and >) %%Date%% %%Time%% %%Header%% %%Body%% %%Body MaxSize%% %%Body_HTML%% %%Body_HTML MaxSize%% %%Size%% %%IP%% current date current time all headers of the message body of the message in plain text body of the message in plain text limited to MaxSize body of the message in HTML (if any) body of the message in HTML limited to MaxSize (if any) size of the message in kb IP address of the sender Page 55

56 %%UniqueID%% %%RFC822_Date%% %%AttachmentNames%% %%Header HeaderItem%% %%Include FileName%% %%Include_Base64 FileName%% %%MessageFile%% %%Copy HeaderItem Position Length%% %%Delete HeaderItem Position Length%% %%FormatDateTime Format%% %%VirusName%% %%VirusDBDate%% %%SpamScore%% %%SpamReason%% %%MailboxPath%% %%Mailbox%% %%Alias%% %%Forward_recipients Host#port%% %%Forward_local_recipients Host#port%% %%Forward_domain_recipients Host#port;domain1;domain2%% %%Auth_Emai%% %%Auth_Username%% %%Secure_Connection%% %%BCC_Recipient%% %%PORT%% %%Local_IP%% %%Local_PORT%% %%RFC822_Date Num%% Unique ID string (md5 random hash) date and time of message arrival in RFC822 format, based on server time and GMT offset names of the attachments delimited with semicolon Use rarely. Requires a high CPU usage and processing time. particular message header. Eg: %%Header X-Mailer%% includes content of the filename. See the example at the end of the <install_dir>/examples/variables.dat file. The file itself can contain server variables. includes filename in Base64 encoding. See the example at the end of the <install_dir>/examples/variables.dat file. filename (.tmp or.imap file) storing actual content of the message copy Length characters of HeaderItem from Position (Position is zero based) delete Length characters of HeaderItem from Position (Position is zero based) formated date of the message Eg: Today is %%FormatDateTime yyyy-mm-dd hh:nn:ss%% names of the viruses (within the message) delimited with semicolon last update date of the database for IceWarp Anti-Virus engine result of antispam filters reason why message has been marked as spam Account variables used only in certain places list of all recipients prepared for relay to the given Host, delimited with semicolons Eg: %%Forward_recipients mail.domain.com%% NOTE: This variable (and the two following ones) are valid in every place, where %%Recipient%% is valid. similar to %%Forward_recipients%%, but only local accounts are added to the output similar to %%Forward_recipients%%, but only recipients from given domains are added to the output address of the authenticated user (without < and >), or empty if nobody authenticated username of the authenticated user (without < and >), or empty if nobody authenticated "1" or "0" indicates if connection is secured (either via direct SSL, or using STARTTLS) list of recipients not present in TO: or Cc: headers, delimited with semicolon(s) (even with < and >). If this variable is used in content filter during "copy incoming/outgoing mail" operation (using the "apply content filter" option), original recipients are used, not the recipients where the message is being copied to. port of the sender active local IP address active local port date and time Num seconds in the future in RFC822 format, based on server time and GMT offset Eg: %%RFC822_Date 60%% Page 56

57 %%SpamProbability%% %%SpamPercentage%% %%SpamHits%% %%PhoneAlias%% %%InstallPath%% %%Temp%% %%Exec CommandPath%% SPAM probability returned from Bayesian filter SPAM probability returned from Bayesian filter in percent units total message SPAM score phone alias of user path to server installation directory contains last fetched line from client, suitable for Milter filters variable is replaced by string returned by executable at CommandPath Server Functions The following table describes the server functions you can use at certain places within the system. These functions are similar to server variables but are more complex than simple variables. Please be aware that not all functions are applicable or available for all areas of the server. Function %%StrReplace VarName OldString NewString CaseSensitivity%% Returns This function replaces an old string with a new one in a value of the variable specified within the VarNameparamenter. Parameters: VarName name of the variable (without the %% signs) within its value the OldString will be searched for OldString string which you want to search for (within the VarName variable value) NewString string replacement for OldString CaseSensitivity number 0 means that search for OldString is case insensitive, 1 means that search is case sensitive Example: You have this content filter rule: %%StrReplace subject pub bar 1%% and message with Subject: Good pub the variable will be replaced with the following string: Good bar pub within the Subject variable is replaced with bar. %%CharEscape VarName EscapeSeq ListOfChars%% This function adds an escape sequence before any of characters within the ListOfChars string. Parameters: VarName name of the variable (without the %% signs) that will be examined for characters defined within ListOfChars EscapeSeq escape sequence which will be added before any character from ListOfChars typically something like "\" ListOfChars case sensitive list of characters that need to be escaped Example: You have this content filter rule: %%CharEscape from 1%% and message from info@marks&spencer.com the variable will be replaced with info\@marks\&spencer.com Page 57

58 Server Commands These special extended variable commands work only for Auto Responders and Content Filter message actions. Command $$SetSender Sender$$ $$SetRecipient Recipient$$ $$SetActualTo To$$ $$SetActualFrom From$$ $$SetSubject Subject$$ $$SetReplyTo ReplyTo$$ $$SetMessageID MessageID$$ $$SetPartBoundary PartBoundary$$ $$SetContentType ContentType$$ $$SetHeader Header$$ $$Exec CommandPath$$ Sets sender of the message to some value. recipient of the message to some value. To header to some value From header to some value Subject to some value ReplyTo header to some value MessageID to some value Boundary (used for messages with attachment, see the example at the end of this file) Content Type of particular Boundary (see the example at the end of this file) some header to some value application at CommandPath is executed (not available in auto responder) Example #1 (Simple Auto Responder): Hello, I received your your message at %%Time%% on the %%Date%% and the size was %%Size%% kb. Example #2 Advanced Auto Responder With an Attachment: Works only for Content Filters with "Send message" or "Reply with message" actions (not for normal AutoResponders, because of security). $$SetSubject Message Subject: %%Subject%%$$ $$SetPartBoundary --BoundaryXX$$ ----BoundaryXX Content-Type: text/plain This is the text part of the message. The following part contains an attachment image. ----BoundaryXX Content-Type: application/octet-stream; name="image.gif" Content-Transfer-Encoding: base64 %%Include_Base64 c:\temp\image.gif%% ----BoundaryXX Example #3 (Message Containing only Attachment): Works for Content filters only $$SetHeader Content-Type: application/octet-stream; name="filename.ext"$$$$setheader Content-Transfer-Encoding: base64$$ %%Include_Base64 d:\daily.txt%% Example #4 (Virus Warning): Page 58

59 Warning: Virus '%%VirusName%%' detected. Message was rejected. Message's header: %%Header%% Example #5 Advanced Auto Responder With an Embedded Image: Works only for Content Filters with "Send message" or "Reply with message" actions (not for normal AutoResponders, because of security). $$SetSubject Message Subject: %%Subject%%$$ $$SetPartBoundary --BoundaryXX$$ ----BoundaryXX Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <body>this is the text part of the message. The following part contains an attachment image.<br><img src="cid: f24b5a "></body> ----BoundaryXX Content-Type: image/gif; name="image.gif"; charset="utf-8"; Content-Transfer-Encoding: base64 Content-ID: < f24b5a > Content-Disposition: inline; filename="image.gif" %%Include_Base64 <path_to_image>%% ----BoundaryXX Page 59

60 Server Upgrade Best Practices Planning Upgrade search the context help and knowledge base for relevant up-to-date articles schedule downtime for server services optionally, have someone skilled available to handle possible issues or negotiate a managed upgrade with the IceWarp Support team upgrades from versions older than should be performed in two phases upgrade to first and make sure your system is stable and working fine (let it run for few days), upgrade to the current (wished) version after Prior Upgrade make a backup of all user settings via IceWarp Administration Console optionally, you can copy the whole installation directory without mails and logs dump or copy (SQLite) all databases (skip WebClient cache its backup is optional) the goal is to be able to create the same server state as there is at the moment of backup delete session data from the <install_dir>/php/temp/ directory; this step is optional, but should be done when upgrading between major versions if you are synchronizing accounts from LDAP/AD, set c_system_adsyncmaxdeletethreshold to 1 to prevent any losses of account data increase logging levels of SMTP, GroupWare, Control services to extended, make sure you log at least failed SQL queries and API any customizations made in the php.ini file should be noted, it is strongly recommended to create the php.user.ini file (read the php.user.ini Advantages chapter (manual.chm Shared Topics) to learn more) Upgrade on Linux, download and untar the installer tarball, stop all running IceWarp Server services, check that all services are really stopped and kill any running and then run install.sh located in the installer root folder on Windows, close the admin console (config.exe), execute the installer wizard (it must be executed with elevated privileges, the installer attempts to elevate itself), do not stop IceWarp Server services wait for the upgrade finish, do not terminate the process unless it is stuck. Upgrade process can take long time depending on data amount on server as well as on the server performance. Please, be patient as prematurely terminated upgrade leads to unpredictable behavior and serious issues. on Windows, it may be worthwhile to have task manager launched while running installation to see that all services are really stopped during the process After Upgrade check error logs frequently check SQL logs for errors previously made customization to definition of tables in databases (enlarged column) can (in a very rare cases) lead to a problem with data being too long to fit the column. Alter problematic columns back as they were prior the upgrade the installer is never shortening columns, but it may enlarge a column to a smaller size than the customization was. if applicable, set the c_system_adsyncmaxdeletethreshold property back to its original value try to create new event, send a test Page 60

61 ask users for feedback let the system run for few days with increased logging level for troubleshooting if required if suspecting a problem, but not sure, consult it with the IceWarp Support team damaged or inconsistent database usually leads to rollback and data loss, the sooner such an issue is identified the better Upgrade to Version 11.3 There are some changes regarding our integrated OpenLDAP server and client: Client Untill now, 64-bit Windows IceWarp Server used the Windows LDAP library, but on 32-bit administrators could set the C_Accounts_Global_LDAP_UseWindowsDLL variable to false and then the OpenLDAP client library was used. Since version 11.3, the C_Accounts_Global_LDAP_UseWindowsDLL variable has no effect. Windows LDAP library is always used on Windows (and OpenLDAP on Linux). Server New V 11.3 installations: OpenLDAP will be installed When LDAP server logs are enabled, they will go to the IceWarp Server log directory (the slapd.conf file). It is not rotated/marked with timestamp as of now. Servers that were upgraded to V 11.3 from older versions: Ancient OpenLDAP server will be left there LDAP tools that crashed will be replaced with newer versions It is not possible to perform a simple upgrade, because the LDAP database changed its binary format between these two versions (there is a 10 year gap). It would be dangerous to upgrade user's LDAP servers automatically there can be some peculiar configuration. Find details of needed upgrade steps further: 1. It is a good idea to stop all IceWarp Server services and config before performing the migration. As the absolute minimum, stop the LDAP server and check that Windows LDAP dll is used not OpenLDAP. 2. Export the database content to ldif running this command in the ldap directory slapcat.exe -l backup.ldif -f slapd.conf 3. Then copy the backup.ldif file to some safe place. 4. If you did some modifications in the slapd.conf file, copy it to the some safe place. 5. Delete the ldap subdirectory from IceWarp Server installation directory. 6. Run the IceWarp Server installer. It need not to be an upgrade one, the same version like the already installed will suffice. Note that this will stop IceWarp Server services temporarily. 7. After installation, copy backup.ldif to the newly created ldap subdirectory. 8. If you backed up also the slapd.conf file, merge it with the current slapd.conf. The merge would not be difficult, there were not so many changes, most of them are just comments. 9. Delete the ldap\ directory data. 10. Run the following command: slapadd.exe -l backup.ldif -f slapd.conf 11. Start the LDAP server. SQLite Database When server upgrade from version 10 to version 11 is performed (in the case you use a database as an account storage), the D_IP database column is converted from VARCHAR(16) to VARCHAR(46). Page 61

62 If you use the SQLite database, this conversion is not done (because of SQLite "liteness"). To workaround this, after server upgrade convert your account database into some other storage other database or file system and back to SQLite. NOTE: Before converting back, delete tables within the original SQLite database. If you want to convert from SQLite to SQLite, the back conversion is not necessary. NOTE: If your server license is expired, it is not possible to upgrade the server. NOTE: SQL logs are ON during all install/upgrade tasks. Page 62

63 Domain Admin Rights Here you can define the rights for domain administrators. The most options are self-explanatory. (The Restricted privileges option if ticked, the appropriate domain administrator has only rights to change passwords within the administered domain.) By default, you can assign the rights to manage particular type of accounts. If you check it only in the dialog, it means this domain administrator will have rights to manage such accounts only in the domain it belongs to. If you want to assign this domain administrator also rights for different domains, you have to use the domain.dat file click the Advanced button to edit the file. In that file, you can assign rights not only for type of accounts and additional domains but you can also exactly define which domain options can the domain administrator edit/change/see. See the example file for the exact syntax. This domain administrator is also prevented from accessing users mailboxes and read their messages, but can access spam queues. domain.dat File Location This file can be placed: within the <install_dir>/config/ folder in this case, it specifies rights and other settings for all domain administrators on the server within the <install_dir>/mail/<domain>/<user>/ folder in this case, it specifies rights and other settings for this specific user domain administrator. Other Settings You, as a server administrator, may want to restrict domain administrators from changing their domains types, verification ways or other settings. It is possible to do it via the domain.dat file: OPTION=domain_type:0 disables domain Type option within domain WebAdmin OPTION=domain_domatypevalue:0 disables domain type Value option within domain WebAdmin OPTION=domain_value:0 disables domain Verification type within domain WebAdmin Insert the appropriate OPTION to the domain.dat file (either on global level or user one) to disable it. By default these options are enabled. Page 63

64 To determine the right option, refer to the domain.xml file (<install_dir>/html/admin/xml/accounts/), use the option name attribute and syntax as above. It is possible to disable all options at one go (not to disable them one by one) plus enable only some specific ones. Use the OPTION=ALL:0 syntax. To enable some options, set them to 1 (true). E.g.: OPTION=user_password:1. You may want to allow domain administrators to set (some) users from their domains as domain administrators. It can be done within the user.xml file (<install_dir>/html/admin/xml/accounts/). Within the following tag change disable="admin domainadmin" to disable="admin". <OPTION type="listbox" name="user_permissions" function="user_permissions" label="tframeaccounts_usertypelabel" labels="function:user_permissions_labels" value="0 1" disable="admin domainadmin"/> Page 64

65 Schedule The Schedule dialog allows you to define one or more schedules for a task. This dialog is used in various places within IceWarp Server. Clicking the Schedule button opens the Schedule dialog: As you can see from the automatically generated schedules descriptions in the screenshot above you can define quite complex schedules once a day, specific days in a month, at timed intervals, specific days, specific time periods, and so forth. Multiple schedules can be defined for the same task giving you great flexibility and control over your automated tasks. The Force dial connection box is only active if you have IceWarp Server set to use a dial-up connection. Checking the box will cause IceWarp Server to connect each time the schedule is triggered. The buttons allow you to Add, Edit and Delete schedules, clicking the appropriate button opens the Schedule Task dialog, where you can choose when to run this task. Field Days in Week Description Select this option to specify days in the week. Check the box(es) for each day that you wish the task to be performed. In the screenshot above the task is set to run every day. Page 65

66 Days in Month Disabled Once At Every Between Select this option to specify a specific date (or dates) in the month that you wish the task to be run. Multiple dates are specified by separating them with a semi-colon, e.g. 7;14;28 Select this option to disable the current schedule without removing it from the schedule list. This is useful if you wish to stop a schedule running for a while. Choose this option to specify a time that the task will be run on the selected day(s). Enter the time in the format hh:mm Choose this option to have the task run at timed intervals. Enter a number and select Minutes or Hours from the dropdown. In the screenshot above the task would run every 20 minutes. Here you can set a time interval during which a timed task will be performed. Check the box and enter the start and end times. In the screenshot above the task would only run between 06:00 and 18:00 on the scheduled days. Select Accounts This dialogue allows you to pick accounts, domains or groups for the certain object container. Wherever any account, domain or group need to be selected, it is done through this straight forward and simple select dialogue. Field Domain Account type Select Domain Select Account Description Use the list to choose any domain locally hosted. Combo that is allowing you to pre-filter the accounts or groups in the selected domain. Click the button to select all users of the domain chosen in the Domain field. Once you selected the account you want to add to the container (group, mailing list, remote watchdog, quarantine,...), click this button to confirm the selection. Hitting the Cancel button cancels the current selection process and returns to the previous screen. Page 66

67 Server Security Weak Ciphers, PSI Compliance To comply with the PCI standard, IceWarp Server V 11 by default disables weak ciphers and addresses the BEAST attack by prioritization of RC4 ciphers. A new installation of the server will now pass the Qualys SSL Labs test with honors (A ranking). In existing installations, in order to achieve Forward secrecy, but still not vulnerability against BEAST attack, setting the API sslcipherlist value to HIGH is not enough as we need to allow GCM and ECDHE (elliptic) cipher suites explicitly. On installations which were previously set to HIGH, issue the following command and then verify on tool set system c_system_adv_ext_sslcipherlist AES256-GCM-SHA384:AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE- RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:RC4-MD5:RC4-SHA Page 67